BGP is the system that routes traffic across the internet, and RPKI is the security layer that keeps that routing honest. When BGP goes wrong, real websites disappear: in 2008, a single bad route from Pakistan Telecom knocked YouTube offline worldwide for over an hour. This guide explains BGP and RPKI in plain English, uses real incidents to show why they matter, and helps you judge a host on routing security.
You will not need a networking degree to follow this. The ideas are simpler than the acronyms suggest, and the stakes are easier to see once you know the history.
What Is BGP and Why Does It Matter?
The Border Gateway Protocol, or BGP, is how the roughly 75,000 networks that make up the internet tell each other where traffic should go. When someone visits your site, BGP works out the path across those networks to reach your server. It is, in effect, the postal routing system of the internet.
BGP has one historic weakness, though. It was built on trust. Networks announce which addresses they handle, and other networks have traditionally just believed them. That trust is efficient, but it opens the door to a serious problem: route hijacking. And this is not rare. Since the start of 2020, researchers have logged over 1,400 BGP hijacking incidents, and one analysis counted more than 18,000 route hijacks in the first quarter of 2022 alone.
The Problem: Route Hijacking and Leaks, With Real Examples
A route hijack happens when a network wrongly announces that it owns IP addresses it does not. Because BGP trusts announcements, traffic meant for the real owner gets pulled toward the impostor. The history of the internet is full of costly examples, and they are worth knowing.
The YouTube blackout (2008)
Pakistan Telecom tried to block YouTube domestically by announcing a false route for its IP prefix. The route leaked to its upstream provider and spread globally. Within minutes, YouTube traffic worldwide was redirected to Pakistan, taking the site down for over an hour until the real route was restored.
The MyEtherWallet crypto theft (2018)
Attackers hijacked IP prefixes belonging to Amazon’s Route 53 DNS service. Visitors to the MyEtherWallet cryptocurrency site were silently redirected to a fake server, and roughly 150,000 dollars in cryptocurrency was stolen. This showed hijacking is not just about outages; it enables theft.
The Apple and Cloudflare incidents (2022 and 2024)
In July 2022, Russia’s Rostelecom announced routes for part of Apple’s network, misdirecting traffic for hours. Then in June 2024, a combined hijack and route leak made Cloudflare’s 1.1.1.1 DNS resolver unreachable from over 300 networks across 70 countries. Tellingly, Cloudflare was already an RPKI adopter, which shows routing security only works when enough networks participate.
How RPKI Protects Routing
RPKI, or Resource Public Key Infrastructure, adds cryptographic proof to routing. Network owners publish a signed record called a Route Origin Authorization, or ROA, that states which network is allowed to announce their IP blocks. Other networks then check announcements against these signed records and reject the ones that fail.
As a result, when a network tries to announce addresses it has no authorization for, RPKI aware networks drop the false route. In plain terms, RPKI turns BGP’s honour system into a verified one. It is widely regarded as the best available defence against accidental hijacks and origination leaks.
The Honest Truth: RPKI Adoption Is Still a Work in Progress
Here is the part many hosting pages leave out. RPKI only works when networks both sign their routes and reject invalid ones, and adoption is uneven. More than 50 percent of announced prefixes are now covered by ROAs, which is real progress. However, only around 25 percent of networks actually enforce validation by dropping invalid routes.
The user level picture is starker. One Cloudflare analysis estimated that of roughly four billion internet users, only about 261 million, or 6.5 percent, were fully protected by route origin validation. Consequently, RPKI is necessary but not yet sufficient on its own. That is exactly why a host signing its own routes matters: it does the part that is within its control, and it adds one more validating, protected network to the total.
Why This Matters When Choosing a Host
Most hosting buyers never ask about routing security, yet the incidents above show it affects the safety of every visit to their site. A host that publishes ROAs for its own IP blocks and maintains accurate routing records is protecting your traffic from the exact class of attacks that took down YouTube, Apple traffic and MyEtherWallet users.
This is a mark of a serious, self operated provider, because only a host that owns its IP blocks can sign them. A reseller renting space cannot. Bisup, for instance, publishes RPKI records for its own IP blocks, described on the network infrastructure page, so the protection covers every service from web hosting to VPS.
RPKI in Context: One Layer of Many
RPKI secures routing, but it is not the whole security picture. It works alongside other protections you should still expect from a good host and set up on your own site.
At the site level, an SSL certificate encrypts data between your visitors and your server, while firewalls and malware scanning guard the application. At the network level, DDoS mitigation absorbs traffic floods, and RPKI keeps routing honest. Think of RPKI as the layer that makes sure traffic reaches the right place, before the other layers protect what happens once it arrives. Strong hosting layers all of these, so no single failure exposes your website.
Frequently Asked Questions
RPKI stands for Resource Public Key Infrastructure. It is a security framework that lets network owners cryptographically declare which networks may announce their IP addresses, so other networks can reject false or hijacked routing announcements and keep internet traffic on its correct path.
BGP is the protocol that routes traffic between networks across the internet. RPKI is a security layer added on top of BGP that verifies routing announcements are legitimate. In short, BGP moves the traffic, and RPKI helps make sure it moves along authorised, trustworthy paths.
Yes, and it has affected major ones. Hijacks have taken YouTube offline globally, redirected Apple traffic, and stolen cryptocurrency by rerouting Amazon DNS. If your host’s routes are hijacked, visitors can be misdirected or intercepted even though your site is untouched. RPKI reduces this risk substantially.
Partly. Over half of announced prefixes now have signed ROAs, but only about a quarter of networks enforce validation, and by one estimate just 6.5 percent of internet users are fully protected. Adoption is growing steadily, which is why every host that signs its routes adds meaningful protection.
No. RPKI is implemented by network operators and hosts that own IP blocks, not by individual website owners. Your part is choosing a host that already implements it. You focus on site level security like SSL and strong passwords, while the host handles routing protection.
